java.lang.Object
org.eclipse.jetty.util.component.AbstractLifeCycle
org.eclipse.jetty.util.component.ContainerLifeCycle
org.eclipse.jetty.server.handler.AbstractHandler
org.eclipse.jetty.server.handler.AbstractHandlerContainer
org.eclipse.jetty.server.handler.HandlerWrapper
net.i2p.i2pcontrol.HostCheckHandler
All Implemented Interfaces:
Handler, HandlerContainer, Container, Destroyable, Dumpable, LifeCycle
public class HostCheckHandlerextends HandlerWrapper
Block certain Host headers to prevent DNS rebinding attacks. This Handler wraps the ContextHandlerCollection, which handles all the webapps (not just routerconsole). Therefore, this protects all the webapps. This class is NOT used for the webapp or the bare ServerSocket implementation.

  • Field Details

    • _context

      private final I2PAppContext _context
      Supplies the configuration and the log.

    • _listenHosts

      private final Set<String> _listenHosts
      Host names the service will answer for.

  • Constructor Details

    • HostCheckHandler

      public HostCheckHandler(I2PAppContext ctx)
      MUST call setListenHosts(Set) afterwards.
      Parameters:
      ctx - application context, used to obtain the log for rejected Host headers

  • Method Details

    • setListenHosts

      public void setListenHosts(Set<String> hosts)
      Set the legal hosts. Not synched. Call this BEFORE starting. If empty, all are allowed.
      Parameters:
      hosts - contains hostnames or IPs. But we allow all IPs anyway.

    • handle

      public void handle(String pathInContext, Request baseRequest, HttpServletRequest httpRequest, HttpServletResponse httpResponse) throws IOException, ServletException
      Block by Host header, pass everything else to the delegate.
      Specified by:
      handle in interface Handler
      Overrides:
      handle in class HandlerWrapper
      Throws:
      IOException
      ServletException

    • allowHost

      private boolean allowHost(String host)
      Should we allow a request with this Host header? ref: https://en.wikipedia.org/wiki/DNS_rebinding
      Parameters:
      host - the HTTP Host header, null ok
      Returns:
      true if OK

    • getHost

      private static String getHost(String host)
      Strip [] and port from a host header
      Parameters:
      host - the HTTP Host header non-null
      Returns:
      the host with IPv6 brackets and any port removed